{
  "Name": "PRODAFT USTA - Account Takeover Prevention",
  "Author": "PRODAFT - integration@prodaft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/PRODAFTUstaATP.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The **PRODAFT USTA - Account Takeover Prevention** solution ingests compromised corporate credentials from the PRODAFT USTA platform into Microsoft Sentinel via a codeless (Codeless Connector Framework) data connector. Plaintext passwords are dropped at ingestion — only password strength signals (score and length) are retained for triage. Includes analytic rules to alert on newly exposed corporate credentials and on successful Entra ID sign-ins with known-compromised accounts, a hunting query, an overview workbook, and an on-demand backfill playbook for loading historical data.",
  "Workbooks": [
    "Workbooks/PRODAFTUstaATPOverview.json"
  ],
  "WorkbookDescription": "Monitors compromised corporate credentials ingested from PRODAFT USTA Account Takeover Prevention: exposure over time, affected companies, infostealer families, leak sources, and password strength.",
  "Analytic Rules": [
    "Analytic Rules/CorporateCredentialCompromised.yaml",
    "Analytic Rules/CompromisedCredentialUsedInSignin.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/InfostealerExposureByCompany.yaml"
  ],
  "Parsers": [
    "Parsers/PRODAFTUstaCompromisedCredentials.yaml"
  ],
  "Data Connectors": [
    "Data Connectors/PRODAFTUstaATP_ccp/PRODAFTUstaATP_ConnectorDefinition.json"
  ],
  "Playbooks": [
    "Playbooks/PRODAFTUstaATP-Backfill/azuredeploy.json"
  ],
  "Version": "3.0.2",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "Is1PConnector": false
}